監控訊息是否已順利推送，方法是查看 subscription/push_request_count (依 response_code) 指標。如果系統回報推送錯誤，請檢查服務記錄。如果接收端點傳回非 OK 狀態碼，表示 Cloud Run 程式碼無法正常運作，您必須與支援團隊聯絡。
Eventarc 觸發條件
本節提供觸發程序問題的疑難排解提示。
權限遭拒錯誤
如果遇到 Failed to load service details: permission denied 錯誤，請確認觸發條件權限設定正確無誤，且 Pub/Sub 服務帳戶已獲派 iam.serviceAccountTokenCreator 角色。詳情請參閱存取權控管一文。
如果在嘗試建立觸發條件時遇到下列錯誤，請稍候幾分鐘 (最多七分鐘)，然後再試一次：
Permission denied while using the Eventarc Service Agent. If you recently
started to use Eventarc, it may take a few minutes before all necessary
permissions are propagated to the Service Agent. Otherwise, verify that it has
Eventarc Service Agent role.
服務代理程式會做為特定專案中特定 Google Cloud 服務的身分。詳情請參閱「服務代理程式」一文，並查看 Eventarc 服務代理程式角色 (roles/eventarc.serviceAgent) 的權限。
如果您嘗試使用跨專案服務帳戶，但遇到 iam.serviceAccounts.getAccessToken 或 iam.serviceAccounts.actAs 的權限遭拒錯誤，或是收到類似 ...cross-project service accounts are disabled 或 Failed to impersonate... 的錯誤訊息，請確認權限設定正確無誤。詳情請參閱「使用跨專案服務帳戶」。
Pub/Sub 主題未顯示 CMEK 金鑰
啟用使用客戶自行管理的加密金鑰 (CMEK) 的 Eventarc 管道，可保護 Eventarc Standard 用於傳輸層的 Pub/Sub 主題。不過，CMEK 金鑰不會透過Google Cloud 控制台顯示。您可以使用 Google Cloud CLI，確認 Pub/Sub 主題是否已啟用 CMEK 金鑰：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis page provides troubleshooting guidance for issues encountered when using Eventarc, including problems with providers, event delivery, triggers, and permissions.\u003c/p\u003e\n"],["\u003cp\u003eVerify that providers exist, that events are from supported regions, and that triggers are configured correctly by checking Cloud Audit Logs and Pub/Sub topic status.\u003c/p\u003e\n"],["\u003cp\u003eIf events are not received, ensure the Pub/Sub topic associated with the trigger exists and that the monitored service is writing logs, and recreate the trigger if the Pub/Sub topic is not found.\u003c/p\u003e\n"],["\u003cp\u003eAddress permission denied errors by confirming trigger permissions, checking the Eventarc Service Agent's role, and ensuring correct configuration for cross-project service accounts.\u003c/p\u003e\n"],["\u003cp\u003eTo prevent unexpected charges, review trigger filters that may lead to infinite trigger activations and set budgets and alerts in the Google Cloud billing console.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot issues\n\n[Standard](/eventarc/standard/docs/overview)\n\nThis page shows you how to resolve issues that you might encounter when using\nEventarc.\n\nFor destination-specific issues that you might also encounter, refer to\ntroubleshooting for:\n\n- [Eventarc for Cloud Run](/eventarc/standard/docs/run/troubleshoot)\n- [Eventarc for GKE](/eventarc/standard/docs/gke/troubleshooting)\n- [Eventarc for Workflows](/eventarc/standard/docs/workflows/troubleshoot)\n\nEventarc provider\n-----------------\n\nThis section provides troubleshooting tips for issues at the source of events\n(the provider).\n\n### Provider doesn't exist\n\nCheck that [the provider exists](/eventarc/docs/list-providers) and that you\nhave [specified the trigger filters](/eventarc/standard/docs/event-providers-targets#triggers)\nappropriately.\n\n### Events are produced from the provider, but are not received at the target\n\nCheck that you are filtering for events from providers that are in a supported\nregion for the target destination. For more information, see\n[locations supported by Eventarc](/eventarc/docs/locations) and\n[Understand Eventarc locations](/eventarc/docs/understand-locations).\n\n### Trigger is not delivering events\n\n1. Verify that the provider is generating events. Check the\n [Cloud Audit Logs](/eventarc/docs/reference/audit-logs#viewing_logs)\n and make sure the monitored service is writing logs. If logs are recorded\n but events are not delivered, [contact support](/eventarc/docs/getting-support).\n\n2. Verify that a Pub/Sub topic with the same trigger name exists.\n\n 1. To list triggers in all locations, run:\n\n gcloud eventarc triggers list --location=-\n\n 2. To list Pub/Sub topics, run:\n\n gcloud pubsub topics list\n\n Verify that the Pub/Sub topic name includes the name of the\n created trigger. If the Pub/Sub topic is missing,\n [create a topic when you create the trigger](/eventarc/standard/docs/event-providers-targets#triggers).\n 3. To describe triggers and detect any issues with the condition of the\n trigger, run:\n\n gcloud eventarc triggers describe \u003cvar translate=\"no\"\u003eTRIGGER_ID\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eTRIGGER_ID\u003c/var\u003e: the ID of the trigger or a fully qualified identifier.\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of the Eventarc trigger.\n 4. The previous command returns the condition of the trigger. If there is an\n issue with the Pub/Sub topic, one of the following conditions is\n returned:\n\n ```\n conditions:\n transport.pubsub.topic:\n code: NOT_FOUND\n message: Pub/Sub topic not found. Try recreating the trigger.\n ```\n\n or \n\n ```\n conditions:\n transport.pubsub.topic:\n code: UNKNOWN\n message: Pub/Sub topic status is unknown. Try requesting the trigger description again.\n ```\n\n If applicable, do the following:\n - If `Pub/Sub topic not found` is returned, recreate the\n trigger for a specific provider, event type, and destination\\](/eventarc/standard/docs/event-providers-targets#triggers)\n and then create the topic.\n\n - If `Pub/Sub topic status is unknown` is returned, run the\n command to describe the trigger again.\n\n - If the problem persists, [contact support](/eventarc/docs/getting-support).\n For more information, see [Manage triggers](/eventarc/docs/managing-triggers).\n\n3. Verify the health of the Pub/Sub topic:\n\n 1. Verify the Pub/Sub topic configuration. Go to the **Topics**\n page.\n\n\n [Go to Topics](https://console.cloud.google.com/cloudpubsub/topic/list)\n\n \u003cbr /\u003e\n\n 2. [Monitor](/pubsub/docs/monitoring#monitoring_forwarded_undeliverable_messages)\n if messages are published to the topic with the metric:\n `topic/send_message_operation_count`. If messages are not published to the\n topic, check [Cloud Audit Logs](/logging/docs/audit#viewing_audit_logs)\n and make sure the monitored service is emitting logs. If logs are recorded\n but events are not delivered, [contact support](/eventarc/docs/getting-support).\n\n 3. [Monitor](/pubsub/docs/monitoring#monitoring_push_subscriptions) if\n messages are pushed successfully with the metric:\n `subscription/push_request_count` by `response_code`. If push errors are\n reported, check the service logs. If the receiving endpoint returns a\n non-OK status code, it indicates that the Cloud Run code\n is not working as expected and you must\n [contact support](/eventarc/docs/getting-support).\n\nEventarc trigger\n----------------\n\nThis section provides troubleshooting tips for issues at the trigger.\n\n### Permission denied errors\n\n- If you encounter a `Failed to load service details: permission denied` error,\n confirm that the trigger permissions are configured correctly, and that the\n Pub/Sub service account is granted the\n `iam.serviceAccountTokenCreator` role. For more information, see\n [Access control](/eventarc/docs/access-control).\n\n- If you encounter the following error while trying to create a trigger, wait a\n few minutes ([up to seven](/iam/docs/access-change-propagation)), and then try\n creating the trigger again:\n\n Permission denied while using the Eventarc Service Agent. If you recently\n started to use Eventarc, it may take a few minutes before all necessary\n permissions are propagated to the Service Agent. Otherwise, verify that it has\n Eventarc Service Agent role.\n\n A service agent acts as the identity of a given Google Cloud service for a\n particular project. For more information, see\n [Service agents](/iam/docs/service-agents) and view the\n [permissions](/iam/docs/understanding-roles#eventarc.serviceAgent) for the\n Eventarc service agent role (`roles/eventarc.serviceAgent`).\n\n To verify that the Eventarc service agent exists in your\n Google Cloud project and has the necessary role, complete the following steps:\n 1. In the Google Cloud console, go to the **IAM** page.\n\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n\n \u003cbr /\u003e\n\n 2. On the **Permissions** tab, select the\n **Include Google-provided role grants** checkbox.\n\n 3. In the list of principals, locate the Eventarc\n service agent, which uses this format:\n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-eventarc.iam.gserviceaccount.com`\n 4. Verify that the service agent has the **Eventarc\n Service Agent** role. If the service agent does not have the role,\n [grant the role](/iam/docs/granting-changing-revoking-access).\n\n- If you are trying to use a cross-project service account and you encounter a\n permission denied error for `iam.serviceAccounts.getAccessToken` or\n `iam.serviceAccounts.actAs`, or if you receive an error message similar to\n `...cross-project service accounts are disabled` or `Failed to impersonate...`,\n confirm that permissions are configured correctly. For more information, see\n [Use a cross-project service account](/eventarc/docs/use-cross-project-service-account).\n\n### Pub/Sub topic not displaying CMEK key\n\n[Enabling an Eventarc channel with a customer-managed encryption key](/eventarc/docs/use-cmek)\n(CMEK) protects the Pub/Sub topic used as a transport layer by\nEventarc Standard. However, the CMEK key is not displayed through the\nGoogle Cloud console. You can verify that a CMEK key is enabled for the\nPub/Sub topic by using the Google Cloud CLI:\n\n1. Describe the Eventarc trigger:\n\n gcloud eventarc triggers describe \u003cvar translate=\"no\"\u003eTRIGGER_ID\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eTRIGGER_ID\u003c/var\u003e: the ID of your Eventarc trigger\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of the trigger\n\n The Pub/Sub topic ID is returned. For example:\n `topic: projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/topics/`\u003cvar translate=\"no\"\u003eTOPIC_ID\u003c/var\u003e\n2. Describe the Pub/Sub topic:\n\n gcloud pubsub topics describe \u003cvar translate=\"no\"\u003eTOPIC_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTOPIC_ID\u003c/var\u003e with the Pub/Sub\n topic ID retrieved in the previous step.\n\n The CMEK key name is returned. For example: \n\n kmsKeyName: projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/keyRings/\u003cvar translate=\"no\"\u003eRING_NAME\u003c/var\u003e/cryptoKeys/\u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e/grants/\u003cvar translate=\"no\"\u003eGRANT_ID\u003c/var\u003e\n\n### Unexpected charges when using Eventarc\n\nWhen you create a trigger, check if the filters configured could lead to\ntriggers being set off indefinitely. To help avoid unexpected charges on your\nbill, set budgets and alerts using Google Cloud's billing console. For more\ninformation, see [Create a budget](/billing/docs/how-to/budgets#create-budget).\n\nRelated information\n-------------------\n\n- To learn more about Eventarc, see the [overview](/eventarc/standard/docs/overview).\n- For a tutorial on Eventarc troubleshooting, see [Debug a Cloud Run service using Eventarc](/eventarc/standard/docs/run/debugging-events-cloud-run).\n- For event publishing issues, see [Troubleshoot event publishing](/eventarc/standard/docs/third-parties/troubleshoot-providers).\n- To get additional help, see [Get support](/eventarc/docs/getting-support)."]]
